Directories under /proc

The directories under /proc whose names are integer values represent processes currently alive on the system. The name of the directory is the PID of the process (technically, it's the TGID of the process. We covered TGID/PID in the companion guide Linux Kernel Programming in Chapter 6, Kernel and Memory Management Internals Essentials).

This folder – /proc/PID/ – contains information regarding this process. So, for example, for the init or systemd process (always PID 1), you can examine detailed information about this process (its attributes, open files, memory layout, children, and so on) under the /proc/1/ folder.

As an example, here, we will gain a root shell and do ls /proc/1:

Figure 2.1 – Screenshot of performing ls /proc/1 on an x86_64 guest system

The complete details regarding the pseudo files and folders under /proc/<PID>/... can be found on the man page of proc(5...